hxxps://xoici7hbb[.]cc[.]rs6[.]net/tn[.]jsp?f=001rDZRcuQFZunD4EWbvtX9h6kkqtqwrYt31919xJ9waqg_hKpyBVfaE39GviCBR8wKQZjbVpkZRpn9vyHI4S3lDH9WDfhzGvGln5zov8LIgsYOqsJ98cJe1n9bovY0zi7n-mttY3JztLT_XMGvil0ddQVghSGRwXmIgyiTLJ6eEaZAyVWjyhTFSPr5hCStpsfATR6ooN93_UzGSht7_OdF_bXrsZdNcnaPuy2Lod7VVcNVYcW3ukc9JiVsms7NG-aTvsw6cOiQarDsz23bXQeNQvkUnth8AOhfplQRPMYh_5wzbXduzUjCRg==&c=vrUkqaFL4GJezoTDgaIu1Baa0_X5Pozml0Q6Sn_zHbEc5XOZvqsM6A==&ch=jjeae9jSVePn8KizCHLitGQFahmLyjEHsj7Rl4D2BRAesjK2HnS7Yg==&_utm_id=48c21dc5-276e-48f4-a564-07f0f3e82b20&_email=mjohnson@serverless-solutions[.]com

Analysis

geolocation tags

eueuropefrfrance
max time kernel
149s
max time network
145s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/10/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://xoici7hbb.cc.rs6.net/tn.jsp?f=001rDZRcuQFZunD4EWbvtX9h6kkqtqwrYt31919xJ9waqg_hKpyBVfaE39GviCBR8wKQZjbVpkZRpn9vyHI4S3lDH9WDfhzGvGln5zov8LIgsYOqsJ98cJe1n9bovY0zi7n-mttY3JztLT_XMGvil0ddQVghSGRwXmIgyiTLJ6eEaZAyVWjyhTFSPr5hCStpsfATR6ooN93_UzGSht7_OdF_bXrsZdNcnaPuy2Lod7VVcNVYcW3ukc9JiVsms7NG-aTvsw6cOiQarDsz23bXQeNQvkUnth8AOhfplQRPMYh_5wzbXduzUjCRg==&c=vrUkqaFL4GJezoTDgaIu1Baa0_X5Pozml0Q6Sn_zHbEc5XOZvqsM6A==&ch=jjeae9jSVePn8KizCHLitGQFahmLyjEHsj7Rl4D2BRAesjK2HnS7Yg==&_utm_id=48c21dc5-276e-48f4-a564-07f0f3e82b20&[email protected]
Sample261023-e4c1gszw2n

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL 2 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	7	[email protected]	2516	chrome.exe
Email address	12	[email protected]	2516	chrome.exe	1

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2516	chrome.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
4256	chrome.exe
4256	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe
Token: SeShutdownPrivilege	1280	chrome.exe
Token: SeCreatePagefilePrivilege	1280	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe
1280	chrome.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 4744	1280	chrome.exe	83
PID 1280 wrote to memory of 3628	1280	chrome.exe	84
PID 1280 wrote to memory of 3628	1280	chrome.exe	84
PID 1280 wrote to memory of 2516	1280	chrome.exe	85
PID 1280 wrote to memory of 2940	1280	chrome.exe	86
PID 1280 wrote to memory of 2940	1280	chrome.exe	86
PID 1280 wrote to memory of 3372	1280	chrome.exe	88
PID 1280 wrote to memory of 3464	1280	chrome.exe	89
PID 1280 wrote to memory of 3372	1280	chrome.exe	88
PID 1280 wrote to memory of 3464	1280	chrome.exe	89
PID 1280 wrote to memory of 4492	1280	chrome.exe	90
PID 1280 wrote to memory of 4492	1280	chrome.exe	90
PID 1280 wrote to memory of 3236	1280	chrome.exe	91
PID 1280 wrote to memory of 3236	1280	chrome.exe	91
PID 1280 wrote to memory of 4740	1280	chrome.exe	92
PID 1280 wrote to memory of 4740	1280	chrome.exe	92
PID 1280 wrote to memory of 3536	1280	chrome.exe	97
PID 1280 wrote to memory of 2364	1280	chrome.exe	103
PID 1280 wrote to memory of 4304	1280	chrome.exe	104
PID 1280 wrote to memory of 3880	1280	chrome.exe	105
PID 1280 wrote to memory of 4256	1280	chrome.exe	106

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://xoici7hbb.cc.rs6.net/tn.jsp?f=001rDZRcuQFZunD4EWbvtX9h6kkqtqwrYt31919xJ9waqg_hKpyBVfaE39GviCBR8wKQZjbVpkZRpn9vyHI4S3lDH9WDfhzGvGln5zov8LIgsYOqsJ98cJe1n9bovY0zi7n-mttY3JztLT_XMGvil0ddQVghSGRwXmIgyiTLJ6eEaZAyVWjyhTFSPr5hCStpsfATR6ooN93_UzGSht7_OdF_bXrsZdNcnaPuy2Lod7VVcNVYcW3ukc9JiVsms7NG-aTvsw6cOiQarDsz23bXQeNQvkUnth8AOhfplQRPMYh_5wzbXduzUjCRg==&c=vrUkqaFL4GJezoTDgaIu1Baa0_X5Pozml0Q6Sn_zHbEc5XOZvqsM6A==&ch=jjeae9jSVePn8KizCHLitGQFahmLyjEHsj7Rl4D2BRAesjK2HnS7Yg==&_utm_id=48c21dc5-276e-48f4-a564-07f0f3e82b20&[email protected]
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffa9e00c728,0x7ffa9e00c734,0x7ffa9e00c740
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,4033875449522960520,13165299708187868682,262144 --field-trial-handle=2016,i,12966750897617026149,11989611397272738839,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:3628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2268,i,2895886443159764258,5754408651646366848,524288 --field-trial-handle=2016,i,12966750897617026149,11989611397272738839,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - A potential corporate email address has been identified in the URL
  - System Time Discovery
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,12809952556151065064,8578117482047745282,524288 --field-trial-handle=2016,i,12966750897617026149,11989611397272738839,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3156,i,3919386449453949424,14184767215838700877,2097152 --field-trial-handle=2016,i,12966750897617026149,11989611397272738839,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3160,i,8316609978785978841,12591982997041787288,2097152 --field-trial-handle=2016,i,12966750897617026149,11989611397272738839,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4548,i,1162571478811988968,11230711920480790669,2097152 --field-trial-handle=2016,i,12966750897617026149,11989611397272738839,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3220,i,1468819969793677916,5538668951340695996,2097152 --field-trial-handle=2016,i,12966750897617026149,11989611397272738839,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=4520 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4700,i,17951690910666552831,2064054482290260655,2097152 --field-trial-handle=2016,i,12966750897617026149,11989611397272738839,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5228,i,18004591302951558401,4145369290928566852,524288 --field-trial-handle=2016,i,12966750897617026149,11989611397272738839,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5240,i,10512748516378897795,5003217287469269280,524288 --field-trial-handle=2016,i,12966750897617026149,11989611397272738839,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,5310817925271639478,15227678358112417990,524288 --field-trial-handle=2016,i,12966750897617026149,11989611397272738839,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5232,i,15890519942085364852,16162703811668214359,524288 --field-trial-handle=2016,i,12966750897617026149,11989611397272738839,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5900,i,17430542889762018451,11968440587923933118,262144 --field-trial-handle=2016,i,12966750897617026149,11989611397272738839,262144 --variations-seed-version=20260911-090036.930000-production --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4256

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

23dda966-0e49-4045-944a-8f28d838ebbc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\23dda966-0e49-4045-944a-8f28d838ebbc.tmp
Size 131KB
SHA256 156ca6a2569d4e8d6751bdc35be095a4e3b708e39819d00c5341ad1226e5f1d4
MD5 98177a18da5a7a842df4ee340bef5297
SHA1 da7f236bd9c391202c41bed1495a1a1dc538e8bc
SHA512 af6de35a03c4b34cd2b4efbef8c7a13f668b22cc35a3cfd1d773ae149b83fbebe72f8422aa028d391d57c6e7fc272b01c57aa6398813e89d13b9c86ded57b3bf
SSDEEP 3072:DIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzB:rPtbmf1K49XLWbEPi4NTKlLzB
TLSH
T16AD312213E41BCB4A9EEDB21B1902A15EAB8D94B953D3BE61CDE3F4805E36D9C304C53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c60ef93-3c34-4032-ac53-df144379c3d5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3c60ef93-3c34-4032-ac53-df144379c3d5.tmp
Size 132KB
SHA256 bff07aff9c7d9378c8c86208a57a3c39967675b5d8ce3ad813f14ab2ef379e41
MD5 b11c267bd19972bb32f4ed8856d0507c
SHA1 7a9f25c424c91d6415d4534ba60e86e04527fbab
SHA512 17d757bafc5c30cee83b8871c58d7c592a0c734e281b40e5c2ebe89031e63ee0fab0d304b7bb740564af98585b7c73f485dd7ea796c89f60738433c825507d02
SSDEEP 3072:OIIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzB:OkPtbmf1K49XLWbEPi4NTKlLzB
TLSH
T1E4D312213D51BCB4A9EEDB21A1502A16EAF8D94B953D3BE61CDE3F4805E36D9C304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ad20c69-a820-43aa-893d-e5979e2446e5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8ad20c69-a820-43aa-893d-e5979e2446e5.tmp
Size 132KB
SHA256 3a90adfbf83cd3d2a5946c2c6415a02573a95c06998645e8db532523200bdd69
MD5 7afadae2f94528cfa68930e44883fce8
SHA1 b891bb9a5ba80789ba28e2b348cb642afa0b91f2
SHA512 b0b705a9b8566e27963e708a3f5d99ca107eed554311ca49c56c3588b8443ebf076bda4297fb75e50455cf37c42dcb6b83e7532d0f1d345bad4f827bcf211657
SSDEEP 3072:LIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzB:zPtbmf1K49XLWbEPi4NTKlLzB
TLSH
T1E0D312613D45BCB499EEEB21A1902A15E9B8D84B953D3BE55CDE3F8806E36DCC304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93c36860-e2cd-4038-801d-e3a6f9f16131.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\93c36860-e2cd-4038-801d-e3a6f9f16131.tmp
Size 132KB
SHA256 2b78fda4ee9aa9346517cd862a06f78e2bf9d1342ecce48a4c9a202f40f4e42e
MD5 d5abec0f41e888390cd5b2d8db9e7f91
SHA1 3685d2d9ea5b4bc1e1c352ab158ea82b313b42df
SHA512 2642898daddd7ae9ef357e1fd03d8720495fa929c6df34efe50e8a95aa644efe532ade9105e724e6456d1b58b532b1a0911b6c0f4c62a30d2bc236983a81762b
SSDEEP 3072:/IIvyBkjartaCS+uW8lH5W+f1K49XLWb9TBAPi4NXbHKji+ZLzB:/kPtbmf1K49XLWbEPi4NTKlLzB
TLSH
T1FFD302213D51BCB4A9EEDB21A1502A16EAF8D94B953D3BE61CDE3F4805E3699C304C63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

133542bb-ff6e-4bff-9d46-441836383608.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\133542bb-ff6e-4bff-9d46-441836383608.tmp
Size 12KB
SHA256 b37d3ba4042e867452588fe8d3065b41f03b8917bc6b487890057dfea8aa686d
MD5 c092a7abc47e3788fcd9a6a68557ec87
SHA1 d8f9d169a88b6191b12fc19943033b21dc92a1f1
SHA512 00f96495f2a9f96448eee210c3d89fc00a85e669431d8014bc28f61ca22f5e2dc0bb79df22440ebdcabdf63cd8ddf433f636ba4bf84f1b0b3dfddf5f813375fa
SSDEEP 192:wRN99p9v7aqpjPRp4GyB9LHsb+WNnSohhFq2xqsegPig6/VyIsnAUgE:wRN9D9rFXX+5wxhC2LP4ZE
TLSH
T11F42B62DAD54697B5CEBC22AF965BB53E3F5103130A01E84E7FC892C25E76CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19bdf6ec-52c6-4c30-9351-2325af702584.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\19bdf6ec-52c6-4c30-9351-2325af702584.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

33d7ef97-3eae-4ee0-ab46-6ee319b80896.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\33d7ef97-3eae-4ee0-ab46-6ee319b80896.tmp
Size 414B
SHA256 bf4e40b3590bba0aeab8ac7338e2c38662433434339c0d7abfcaf8e32ca9bdf5
MD5 5f01db579817893f4b03bca2d8541f00
SHA1 78d03ca4fa0ed29eea8217523bc123ff92051c68
SHA512 1b35bde1cb12fc7c802d48d51fb1736347984861aa7f4f5231d199904b94b39d160f570689d5176a10382ffbdb0cdd15db12fa334ac96c7bb4c17b899e155fc3
TLSH
T168E0F8E5CC30BC330EFC0B0C20908B46E31013972B90888F3A3E810C8FB533A898A86C
MD5 SHA1 SHA512 TLSH

Submit Download

8beaab5d-e1c7-48c0-bb60-5f9f05a0596c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8beaab5d-e1c7-48c0-bb60-5f9f05a0596c.tmp
Size 11KB
SHA256 a9ccd080cc43068d20c5c0b245b806b9a27a331cf6e3b56da30ba4391d728b9c
MD5 59cdf3b61bbd10f39ea4e5027c12f111
SHA1 77a4c7fdfdef1252181ad9d33c3dab561cfe78cb
SHA512 fa0858634e458fd68b6a5ea53af518af997a4640e0ca3821b05d188947f80a2ef4e27d575f2d5a94c861c193a1f3e9e776b7ef00d805653e4c1e2b380487e65f
SSDEEP 192:wRN99p9v7aqpAPRp2GyB9LHsb+WNnSohhFq2xusegPig5/VyIsnAUge:wRN9D9rUX5+5wxhC2zPrZe
TLSH
T1AD42B52DAD54757B4CEBC22AF9657B53D7F6102130A51E84E7FC882C25E76CC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 696B
SHA256 4f4e9a98737123ebaade6d19b19c3a11bdfd986b998232fbde9513837e74dcfd
MD5 b26b0c858081326746e68e842a9da5f8
SHA1 c5fbeb08f893ab9d9bba3679541fc9820fab8091
SHA512 5d0ef0e9f9ac6749d897804e4565dee05a3f0b4cfb35a32c8217506ac5782fdcf44fa49c65f38160a5d39be5875ac4cbd27b53729d168904029c559cd782cf7a
TLSH
T1E501B4C674F10951C71C4BBC74CF1A703238D0A6949B6F17CA945DB55436FE45822135
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.triplekey.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

a29d668a-746c-48bc-89ec-bc6c511e6697.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a29d668a-746c-48bc-89ec-bc6c511e6697.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a347df89-ee3b-4f30-a323-4d1f1d695765.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\a347df89-ee3b-4f30-a323-4d1f1d695765.tmp
Size 9KB
SHA256 1a19f5cf2974349f8f1a5752d963929d9ba51330ab74f8f8b6a651d858e89cda
MD5 9e574c20a905e71aae474d7fac614100
SHA1 fce2f686ae2db4a91db94c10676d1defd6fb010e
SHA512 22c5927b778ddc10aeccfdd66bc7aa2a7f6a6aa68f84702fb19045088629d454d35b26098df7af38d60a16f91ac758294d25fd20e1ee7e75a239aba894c57cdf
SSDEEP 192:D0GVantJwPQcIaaEdFy1/Y3njxQ2aUIO4G+XwSEG1hCm4u2f6Y1kY3Q9DTBBra/i:D0GVantJwPQcIaaEdFy1/Y3nFQ2aUIOg
TLSH
T1C3128DF383F9CA6E880196F45614AD37CE9D0528521C3D66CCE8FE4BA7E3571E20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea47454d-34d3-4238-83f9-5f820c9cb86d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ea47454d-34d3-4238-83f9-5f820c9cb86d.tmp
Size 11KB
SHA256 80771ca56ddce23f92552d1b35a1aab8d08862e401f4a8cd24a64b041217650e
MD5 9b6f30d2eaf991218e9f27cb7cc79878
SHA1 94e30f36462caad95cc96914f2d756b1ad57e262
SHA512 033b479135118696b89c4d274eb4a2b1d8eaf18d96f53f883de45c41ecae15cef77c38b0b20a14013e6510fec778289430e4c5881daf3cdba825e7ed24cc5670
SSDEEP 192:esH4K6Cc7KxkXqK4I40pUZNCgVLHrKHfFKslE/E+XzKD/BE+ErUkKN9v5Y43HK6H:lHjJc7KxkXqKf/pUZNCgVLH2Hfgsl1+8
TLSH
T1E932EA27A88D6E3F0FE8D50DC8166F8FADF5025672640D2852FF9D0803A97CA115A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download